The Big Issues for the Retail Industry and Mobile Device Tracking

Mobile device tracking is a big deal in the retail world, a very big deal. So big that it can transform the retail industry. Which is why last week I attended the FTC’s Mobile Device Tracking Seminar to learn more.

Here’s the big picture:

More and more retailers are using sophisticated technologies like Bluetooth, iBeacons and RFID to track customers on their mobile devices—usually their phones. When customers walk into a store, retailers are tracking them, collecting high-level information about the device such as where it’s located and its route through the store. They crunch that data to learn how to lower their store costs and increase sales. It’s too early in the game to see any metrics, but I’m excited for them to come out.

The benefits are supposed to run both ways. Customers can now have a more relevant shopping experience. For example, a store might recognize my phone and match it against my prior in-store or online purchases to anticipate that I might like a certain cookbook.

Another benefit is that shopping could become more enjoyable for those of us who hate waiting in checkout lines. Soon we will be able to bypass lines altogether by purchasing directly from our mobile devices. That would make me happy.

All these benefits sound great. But as a privacy guy, I am naturally concerned. Are customers fully aware of the data collection happening when they walk in a store? And even if they are, do they know what’s being collected? My first privacy concern is the transparency issue at play.

My second concern is about consent. Right now only real-time location data is collected. Nothing sensitive. That means the opt-out consent model we presently have is sufficient. But I’m a worrier, and I’m worried about data creep. What happens if someone sweeps up sensitive data like my photos, or personal contacts? It’s not right, at least not without my prior explicit consent, and that would require opt-in.

There’s a lot of innovation happening right now in retail, and, in my book, that’s a good thing. While I welcome this innovation, safeguards need to be put in place to ensure that the benefits clearly outweigh the privacy concerns. This isn’t hyperbole. The industry took a good first step at imposing safeguards by adopting the Mobile Location Analytics Code of Conduct, which calls for retailers to be transparent and give the customers control, but I wish it was more meaningful. I can’t help feel like it was a wasted opportunity to get it right.

I see three problems with the code.

Although transparency is the code’s first principle, it’s not clear how companies actually can be transparent. Another sign at the entrance? An announcement over the PA? Retailers don’t want more signs in their stores, and customers don’t read them anyway. The most effective method would be to provide notice when someone downloads the retailer’s app. You could also give them the opportunity to opt-out at the point of download. This limits the tracking to a small pool of mobile devices, but it’s a start. It also would encourage better marketing of the app.

The second problem with the code is the control mechanism. Soon there will be a website where a customer can go and enter their unique 12-digit MAC address to opt out. I’m a big fan of user control, but it has to be meaningful. That’s way too much effort. This isn’t even close.

The third problem is the code lacks any enforcement. It is purely voluntary and has no consequences for noncompliance. This code needs an accountability principle that has a third party actively enforcing it.

Evidon has long been in the vanguard helping companies be transparent with their customers as new opportunities for Big Data intelligence emerge. Drop me a line at truback@evidon.com and let’s talk. We’re pretty good at innovation, too.

Related

There’s a reason Mark Zuckerberg keynoted the Mobile World Congress in Barcelona, Spain, this week, writes Eduardo Ustaran, CIPP/E, in this post for Privacy Perspectives. “The presence of Facebook’s supremo at such an event confirms that the future of the Internet and its players is indeed mobile,” Ustaran writes. All the better, then, that the event also featured a panel on privacy for the first time, where the main topic was building trust. Ustaran pulls out lessons for privacy pros working in...
Read more

In the second installment of this series for The Privacy Advisor looking at monitoring programs across industries, including the privacy consultant, healthcare, IT, finance, government and telecom, Deidre Rodriguez, CIPP/US, talks with Danette Slevinski, vice president and corporate responsibility officer for Bon Secours Charity Health System, where she administers the corporate responsibility and Health Insurance Portability and Accountability Act (HIPAA) privacy program. "By having a monitorin...
Read more

California Sen. Richard Pan (D-Sacramento) wants to overhaul the state’s open data portal and create the role of a chief data officer reporting to the secretary of the Government Operations Agency as leader of the effort, Techwire reports. Pan’s bill “would task the governor with naming a chief data officer no later than Jan. 1, 2016, and require at least 150 data sets to be published on the statewide open data portal by 2017,” the report states. The bill also seeks the creation of “a statewide ...
Read more

ZDNet reports that Australian Communications Minister Malcolm Turnbull and Attorney-General George Brandis agree with a suite of recommendations made by a Parliamentary Joint Committee and that new data retention legislation will soon become law. The law will require telcos to keep a set of customer data, including call records, IP addresses, email address, text history and more, for a minimum of two years so the data can be accessed by law enforcement if necessary. Following the bill’s passage,...
Read more

My first impression of Mark Zuckerberg in the flesh is that he is permanently excited and overflowing with energy. That is hardly surprising given his age and his role in the Internet revolution. But the fact that he dropped by at the Mobile World Congress in Barcelona this week is quite significant. The annual Mobile World Congress is a mega event with nearly 100,000 attendees and the participation of every business with an interest in anything to do with mobile communications. So the presence ...
Read more

Tags

The IAPP is the largest and most comprehensive global information privacy community and resource. Founded in 2000, the IAPP is a not-for-profit organization that helps define, support and improve the privacy profession globally.Learn more

The IAPP is the only place you’ll find a comprehensive body of resources, knowledge and experts to help you navigate the complex landscape of today’s data-driven world. We offer individual, corporate and group memberships, and all members have access to an extensive array of benefits.